Splunk Search

How to achieve stats by the existence of certain fields?

Arishtat
Engager

I have three types of data entries.

 

 

{
<Irrelevant field omitted>
"parameters": [
{
"LicenseNumber": "123456"
}
],
"eventTimestamp": "2023-05-09T15:23:57+0300",
}

{
<Irrelevant field omitted>
"parameters": [
{
"Holder_Id": "654321"
}
],
"eventTimestamp": "2023-05-09T15:23:57+0300",
}

{
<Irrelevant field omitted>
"parameters": [
{
"Name": "John Doe"
}
],
"eventTimestamp": "2023-05-09T15:23:57+0300",
}

 

 

 

I want to get stats how many by the field parameter field type as in Name:69, Holder_Id:42, LicenseNumber:76.

I thought I'd use eval to create a field by the existence of each parameters, but that doesn't work.

<base_query> | eval group_name = case(isnotnull('parameters{}.Name'), Name, isnotnull('parameters{}.HolderId'), HolderId, isnotnull('parameters{}.LicenseNumber'), LicenseNumber) | stats count by group_name

Labels (2)
0 Karma
1 Solution

TrangCIC81
Communicator

Can you try the below?Just removed the single quote and added double quotation marks

<base_query> 
| eval group_name = case(isnotnull(parameters{}.Name), "Name", isnotnull(parameters{}.Holder_Id), "Holder_Id", isnotnull(parameters{}.LicenseNumber), "LicenseNumber") 
| stats count by group_name

  

View solution in original post

0 Karma

TrangCIC81
Communicator

Can you try the below?Just removed the single quote and added double quotation marks

<base_query> 
| eval group_name = case(isnotnull(parameters{}.Name), "Name", isnotnull(parameters{}.Holder_Id), "Holder_Id", isnotnull(parameters{}.LicenseNumber), "LicenseNumber") 
| stats count by group_name

  

0 Karma

Arishtat
Engager

Weird, I'm sure I tried adding double quotes at some point to the eval fields. However, the isnotnull parameter has to be in single quote.

So the correct answer is,

| eval group_name = case(isnotnull('parameters{}.Name'), "Name", isnotnull('parameters{}.HolderId'), "HolderId", isnotnull('parameters{}.LicenseNumber'), "LicenseNumber") | stats count by group_name

Thanks for you help.

gcusello
SplunkTrust
SplunkTrust

Hi @Arishtat,

simplify field names befor an eval command:

| rename 'parameters{}.Name' AS Name 'parameters{}.HolderId' AS HolderId 'parameters{}.LicenseNumber' AS LicenseNumber
| eval group_name = case(isnotnull(Name), Name, isnotnull(HolderId), HolderId, isnotnull(LicenseNumber), LicenseNumber) 
| stats count by group_name

But anyway, if you only want a count of occurrences of each group_name, you could simply use 

| stats count by group_name

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...